total-recall-brain 3.47.0 → 3.47.1

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,15 +2,29 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
-  "use_cases": ["software-development", "state-conformance"],
-  "distribution": { "tier": "core", "license": "open" },
+  "use_cases": [
+    "software-development",
+    "state-conformance"
+  ],
+  "distribution": {
+    "tier": "core",
+    "license": "open"
+  },
   "gate": {
-    "tasks": ["Validate SSSS documents and registries", "Scaffold a standalone SSSS project", "Run the SSSS conformance suites", "Restore a missing SSSS skill or scaffold"],
+    "tasks": [
+      "Validate SSSS documents and registries",
+      "Scaffold a standalone SSSS project",
+      "Run the SSSS conformance suites",
+      "Restore a missing SSSS skill or scaffold"
+    ],
     "owned_commands": [
-      { "pattern": "npx\\s+(--yes\\s+)?@gregiteen/ssss-cli\\s+new\\b", "use": "total-recall ssss scaffold --directory <folder> --json" }
+      {
+        "pattern": "npx\\s+(--yes\\s+)?@gregiteen/ssss-cli\\s+new\\b",
+        "use": "total-recall ssss scaffold --directory <folder> --json"
+      }
     ]
   },
   "cli": {
@@ -19,65 +33,183 @@
     "handler": "cli.mjs",
     "subcommands": [
       {
-        "name": "status", "description": "Inspect the installed engine, skill and full scaffold",
-        "effect": "read", "output": "json",
-        "args": [{"name":"scope","flag":"--scope","label":"Brain scope","type":"choice","options":["auto","project","global"]}]
+        "name": "status",
+        "description": "Inspect the installed engine, skill and full scaffold",
+        "effect": "read",
+        "output": "json",
+        "args": [
+          {
+            "name": "scope",
+            "flag": "--scope",
+            "label": "Brain scope",
+            "type": "choice",
+            "options": [
+              "auto",
+              "project",
+              "global"
+            ]
+          }
+        ]
       },
       {
-        "name": "repair", "description": "Restore missing or previously repinned managed SSSS installation files",
-        "effect": "write", "output": "json",
-        "args": [{"name":"scope","flag":"--scope","label":"Brain scope","type":"choice","options":["auto","project","global"]}]
+        "name": "repair",
+        "description": "Restore missing or previously repinned managed SSSS installation files",
+        "effect": "write",
+        "output": "json",
+        "args": [
+          {
+            "name": "scope",
+            "flag": "--scope",
+            "label": "Brain scope",
+            "type": "choice",
+            "options": [
+              "auto",
+              "project",
+              "global"
+            ]
+          }
+        ]
       },
       {
-        "name": "validate", "description": "Validate a document against the effective SSSS registry",
-        "effect": "read", "output": "json",
+        "name": "validate",
+        "description": "Validate a document against the effective SSSS registry",
+        "effect": "read",
+        "output": "json",
         "args": [
-          {"name":"file","flag":"--file","label":"Document path","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry path","type":"string"}
+          {
+            "name": "file",
+            "flag": "--file",
+            "label": "Document path",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry path",
+            "type": "string"
+          }
         ]
       },
       {
-        "name": "registry", "description": "Verify the effective registry against a lock file",
-        "effect": "read", "output": "json",
+        "name": "registry",
+        "description": "Verify the effective registry against a lock file",
+        "effect": "read",
+        "output": "json",
         "args": [
-          {"name":"lock","flag":"--lock","label":"Registry lock path","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry path","type":"string"}
+          {
+            "name": "lock",
+            "flag": "--lock",
+            "label": "Registry lock path",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry path",
+            "type": "string"
+          }
         ]
       },
       {
-        "name": "scaffold", "description": "Create a complete canonical SSSS project",
-        "effect": "write", "output": "json",
+        "name": "scaffold",
+        "description": "Create a complete canonical SSSS project",
+        "effect": "write",
+        "output": "json",
         "args": [
-          {"name":"directory","flag":"--directory","label":"New project directory","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry name","type":"string"},
-          {"name":"withTotalRecall","flag":"--with-total-recall","label":"Include Total Recall wiring","type":"boolean"}
+          {
+            "name": "directory",
+            "flag": "--directory",
+            "label": "New project directory",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry name",
+            "type": "string"
+          },
+          {
+            "name": "withTotalRecall",
+            "flag": "--with-total-recall",
+            "label": "Include Total Recall wiring",
+            "type": "boolean"
+          }
         ]
       },
       {
-        "name": "conformance", "description": "Run the canonical reference engine conformance suite",
-        "effect": "read", "output": "json"
+        "name": "conformance",
+        "description": "Run the canonical reference engine conformance suite",
+        "effect": "read",
+        "output": "json"
       }
     ]
   },
-  "status": { "command": "status", "refresh_seconds": 60 },
-  "runtime": { "modules": {
-    "installation": "runtime/installation.cjs",
-    "project-scaffold": "runtime/project-scaffold.mjs"
-  } },
+  "status": {
+    "command": "status",
+    "refresh_seconds": 60
+  },
+  "runtime": {
+    "modules": {
+      "installation": "runtime/installation.cjs",
+      "project-scaffold": "runtime/project-scaffold.mjs"
+    }
+  },
   "capability": {
     "entry": "capability/index.mjs",
-    "exports": ["canonicalToolchain", "scaffoldProject", "validateDocument", "verifyRegistry", "runConformance"]
+    "exports": [
+      "canonicalToolchain",
+      "scaffoldProject",
+      "validateDocument",
+      "verifyRegistry",
+      "runConformance"
+    ]
   },
   "branding": {
-    "name": "SSSS", "color": "#b98439", "accent": "#f4c97a", "font": "ibm-plex",
-    "density": "compact", "radius": "sm", "header": "ledger-rule", "logo": "ui/logo.svg"
+    "name": "SSSS",
+    "color": "#b98439",
+    "accent": "#f4c97a",
+    "font": "ibm-plex",
+    "density": "compact",
+    "radius": "sm",
+    "header": "ledger-rule",
+    "logo": "ui/logo.svg"
+  },
+  "auth": {
+    "plugin": "auth",
+    "methods": [
+      "passkey",
+      "google-oauth2"
+    ],
+    "session_verification": true
   },
-  "auth": { "plugin": "auth", "methods": ["passkey", "google-oauth2"], "session_verification": true },
   "ui": {
     "design_tokens": "DESIGN.md",
     "home": "home",
     "elements": [
-      {"id":"home","kind":"panel","tag":"tr-ssss-home","module":"ui/home.js","description":"SSSS installation ledger with document, registry, scaffold and conformance checks"}
+      {
+        "id": "home",
+        "kind": "panel",
+        "tag": "tr-ssss-home",
+        "module": "ui/home.js",
+        "description": "SSSS installation ledger with document, registry, scaffold and conformance checks"
+      }
     ]
-  }
+  },
+  "reuse": {
+    "commands": [
+      "total-recall auth session",
+      "total-recall decision status"
+    ],
+    "owned": "SSSS canonical toolchain, schema/document validation, registry verification, project scaffolding, and conformance checks."
+  },
+  "skills": [
+    {
+      "id": "ssss",
+      "path": "./skills/ssss/SKILL.md",
+      "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations."
+    }
+  ]
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/skills/ssss/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: ssss
+description: "Canonical SSSS distribution, scaffolding and validation for Total Recall installations."
+version: 0.2.0
+repo_scoped: false
+---
+
+# SSSS
+
+Canonical SSSS distribution, scaffolding and validation for Total Recall installations.
+
+## When to Use
+
+Use the `ssss` Total Recall plugin (`total-recall ssss`) instead of ad-hoc scripts or raw commands whenever working on ssss tasks.
+
+## Commands
+
+```bash
+total-recall ssss --help
+total-recall ssss status  # Inspect the installed engine, skill and full scaffold
+total-recall ssss repair  # Restore missing or previously repinned managed SSSS installation files
+total-recall ssss validate  # Validate a document against the effective SSSS registry
+total-recall ssss registry  # Verify the effective registry against a lock file
+total-recall ssss scaffold  # Create a complete canonical SSSS project
+total-recall ssss conformance  # Run the canonical reference engine conformance suite
+```
+
+## Owned Raw Commands
+
+This plugin owns: `npx\s+(--yes\s+)?@gregiteen/ssss-cli\s+new\b`.

package/src/cli/plugin/create.mjs

@@ -274,7 +274,7 @@ export async function createPlugin(args = []) {
     };
   }
 
-  const withSkill = args.includes("--with-skill") || args.includes("--capability") || Boolean(fromSkillPath);
+  const withSkill = !args.includes("--no-skill");
   const isCapability = args.includes("--capability") || Boolean(fromSkillPath);
 
   if (withCli || isCapability || withTask) {
@@ -386,6 +386,7 @@ export default run;
 name: ${id}
 description: "${pluginDesc}"
 version: 0.1.0
+repo_scoped: false
 ---
 
 # ${pluginName}

package/src/cli/plugin/monetization.mjs

@@ -59,43 +59,50 @@ export async function managePluginLicense(args = []) {
     const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
     const amount = mon.price_cents || 1000;
     const currency = (mon.currency || 'USD').toLowerCase();
-    const successUrl = 'https://total-recall.ai/plugins/success';
-    const cancelUrl = 'https://total-recall.ai/plugins/cancel';
-    try {
-      const script = TR.endsWith('.mjs');
-      const stripeRes = spawnSync(script ? process.execPath : TR, [
-        ...(script ? [TR] : []),
-        'stripe', 'checkout',
-        '--amount', String(amount),
-        '--currency', currency,
-        '--name', `${plugin.manifest.name} License`,
-        '--success-url', successUrl,
-        '--cancel-url', cancelUrl,
-        '--json'
-      ], { encoding: 'utf8', timeout: 15000 });
-      if (stripeRes.status === 0 && stripeRes.stdout) {
-        const parsed = JSON.parse(stripeRes.stdout);
-        const url = parsed.url || parsed.checkout_url || parsed.data?.url;
-        if (url) {
-          if (json) {
-            console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, amount, currency }));
-          } else {
-            console.log(`\n💳 Stripe Checkout Session Created:`);
-            console.log(`   Plugin:       ${plugin.manifest.name}`);
-            console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
-            console.log(`   Checkout URL: ${url}\n`);
-          }
-          return;
+    const baseUrl = (process.env.TR_STORE_BASE_URL || 'http://127.0.0.1:3000').replace(/\/+$/, '');
+    const sIdx = args.indexOf('--success-url');
+    const cIdx = args.indexOf('--cancel-url');
+    const successUrl = (sIdx !== -1 && args[sIdx + 1]) || `${baseUrl}/plugins/success?plugin=${encodeURIComponent(pluginId)}`;
+    const cancelUrl = (cIdx !== -1 && args[cIdx + 1]) || `${baseUrl}/plugins/cancel?plugin=${encodeURIComponent(pluginId)}`;
+    const stripeArgs = [
+      'stripe', 'checkout',
+      '--amount', String(amount),
+      '--currency', currency,
+      '--name', `${plugin.manifest.name} License`,
+      '--success-url', successUrl,
+      '--cancel-url', cancelUrl,
+      '--json'
+    ];
+    if (mon.recipient?.account_id) stripeArgs.push('--account', mon.recipient.account_id);
+    const script = TR.endsWith('.mjs');
+    const stripeRes = spawnSync(script ? process.execPath : TR, [
+      ...(script ? [TR] : []),
+      ...stripeArgs
+    ], { encoding: 'utf8', timeout: 15000 });
+    if (stripeRes.status === 0 && stripeRes.stdout) {
+      let parsed = {};
+      try { parsed = JSON.parse(stripeRes.stdout); } catch {}
+      const url = parsed.url || parsed.checkout_url || parsed.data?.url;
+      if (url) {
+        if (json) {
+          console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, session_id: parsed.id || parsed.session_id || null, amount, currency }));
+        } else {
+          console.log(`\n💳 Stripe Checkout Session Created:`);
+          console.log(`   Plugin:       ${plugin.manifest.name}`);
+          console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
+          console.log(`   Checkout URL: ${url}\n`);
         }
+        return;
       }
-    } catch {}
+    }
+    const errDetail = (stripeRes.stderr || stripeRes.stdout || stripeRes.error?.message || 'Stripe checkout failed').trim();
     if (json) {
-      console.log(JSON.stringify({ plugin: pluginId, price_formatted: mon.priceFormatted, requires_purchase: true }));
+      console.log(JSON.stringify({ ok: false, plugin: pluginId, error: errDetail, price_formatted: mon.priceFormatted, requires_purchase: true }));
     } else {
-      console.log(`\n💳 Commercial License Purchase:`);
-      console.log(`   Plugin: ${plugin.manifest.name} (${mon.priceFormatted})`);
-      console.log(`   Activate license after purchase: total-recall plugin license ${pluginId} activate --stdin\n`);
+      console.error(`❌ Stripe checkout failed for '${pluginId}': ${errDetail}`);
+      console.error(`   Activate an existing license with: total-recall plugin license ${pluginId} activate --stdin`);
     }
+    process.exitCode = 1;
     return;
   }
 
@@ -105,6 +112,33 @@ export async function managePluginLicense(args = []) {
       else console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
       return;
     }
+    const sessIdx = args.indexOf('--session-id');
+    const sessionId = sessIdx !== -1 ? args[sessIdx + 1] : null;
+    if (sessionId) {
+      const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
+      const script = TR.endsWith('.mjs');
+      const vRes = spawnSync(script ? process.execPath : TR, [
+        ...(script ? [TR] : []),
+        'stripe', 'verify-entitlement',
+        '--session-id', sessionId,
+        '--consumer', pluginId,
+        '--amount', String(mon.price_cents || 1000),
+        '--currency', (mon.currency || 'USD').toLowerCase(),
+        '--json'
+      ], { encoding: 'utf8', timeout: 15000 });
+      let vParsed = null;
+      try { vParsed = vRes.stdout ? JSON.parse(vRes.stdout) : null; } catch {}
+      if (vRes.status !== 0 || !vParsed?.entitled) {
+        const msg = vParsed?.error || (vRes.stderr || vRes.stdout || 'Stripe entitlement verification failed').trim();
+        if (json) console.log(JSON.stringify({ verified: false, plugin: pluginId, session_id: sessionId, error: msg }));
+        else console.error(`❌ Stripe entitlement check failed for '${pluginId}': ${msg}`);
+        process.exitCode = 1;
+        return;
+      }
+      if (json) console.log(JSON.stringify({ verified: true, plugin: pluginId, session_id: sessionId, status: 'active', entitlement: vParsed }));
+      else console.log(`✅ Stripe entitlement verified active for '${pluginId}' (session ${sessionId}).`);
+      return;
+    }
     const secretKey = mon.license_key_secret;
     const currentKey = secretKey ? await getSecret(defaultBrainDir(), secretKey, { actor: 'plugin-license' }) : null;
     if (!currentKey?.found || !currentKey?.value) {

package/src/cli/plugin/search.mjs

@@ -2,17 +2,18 @@ import { listAvailableBundled } from '../../core/plugin-store.mjs';
 
 function parseArgs(args) {
   const isJson = args.includes('--json');
+  const isStore = args.includes('--store');
   let useCase = null;
   const words = [];
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === '--json') continue;
+    if (args[i] === '--json' || args[i] === '--store') continue;
     if (args[i] === '--use-case' && args[i + 1]) {
       useCase = args[++i];
       continue;
     }
     words.push(args[i]);
   }
-  return { isJson, useCase, query: words.join(' ').toLowerCase().trim() };
+  return { isJson, isStore, useCase, query: words.join(' ').toLowerCase().trim() };
 }
 
 /**
@@ -108,7 +109,28 @@ export async function listPeers(args = []) {
 
 /** `plugin search <query>` — bundled plugins plus whatever mesh peers share. */
 export async function searchPlugins(args = []) {
-  const { isJson, useCase, query } = parseArgs(args);
+  const { isJson, isStore, useCase, query } = parseArgs(args);
+  if (isStore) {
+    const base = (process.env.TR_STORE_URL || 'http://127.0.0.1:3000').replace(/\/+$/, '');
+    const params = new URLSearchParams();
+    if (query) params.set('q', query);
+    if (useCase) params.set('use_case', useCase);
+    const res = await fetch(`${base}/api/store/plugins${params.toString() ? `?${params}` : ''}`);
+    if (!res.ok) throw new Error(`Store catalog unavailable (HTTP ${res.status})`);
+    const data = await res.json();
+    const storePlugins = data.plugins || [];
+    if (isJson) {
+      console.log(JSON.stringify({ store: storePlugins }, null, 2));
+      return;
+    }
+    console.log(`\n🛒 Store plugins matching "${query || '*'}"${useCase ? ` (use case: ${useCase})` : ''}\n`);
+    if (storePlugins.length === 0) {
+      console.log('No store plugins found.\n');
+      return;
+    }
+    for (const p of storePlugins) printPlugin(p, `store:${p.id}`);
+    return;
+  }
   const bundled = listAvailableBundled(process.cwd()).filter((p) => matches(p, query, useCase));
   const { listPeerPlugins } = await import('../../core/plugin-peers.mjs');
   const peers = await listPeerPlugins();

package/src/cli/preflight.mjs

@@ -7,7 +7,7 @@ import { globalBrainDirFor, isBrainEnabled } from '../core/brain-registry.mjs';
 import { GATE_MODES, gateConfigPath, projectBrainDir, readGateLayers, resolveGateMode, writeGateMode } from '../core/gate-mode.mjs';
 import { installHarnessHooks, loadGateAdapters } from '../core/harness-hooks.mjs';
 import { ackDirectory, capsuleVerb, decide, gatePackageBroken, isAckCommand, isCheckCommand, isRouteCommand, isSubagentPayload, nativeToolOf, sessionOf, SWEEP_CONSULT_MS, whenGateFails } from '../core/preflight-gate.mjs';
-import { ACK_COMMAND, acknowledge, checkAgentReceipt, checkAnyReceipt, findRoot, forgetCapsuleDeliveries, lastArrivalMs, lastCapsuleDelivery, lastConsultMs, lastRoutedMs, lastRouteWarnedMs, lastSessionAck, markArrival, markDelegated, markRouted, markRouteWarned, markSessionAck, noteCaller, recordDecision, sessionHasStanding, sessionKey, readDecisions, takeCaller } from '../core/preflight-receipt.mjs';
+import { ACK_COMMAND, acknowledge, checkAgentReceipt, checkAnyReceipt, findRoot, forgetCapsuleDeliveries, lastArrivalMs, lastCapsuleDelivery, lastConsultMs, lastRoutedMs, lastRouteSelection, lastRouteWarnedMs, lastSessionAck, markArrival, markDelegated, markRouted, markRouteSelection, markRouteWarned, markSessionAck, noteCaller, recordDecision, sessionHasStanding, sessionKey, readDecisions, takeCaller } from '../core/preflight-receipt.mjs';
 
 const USAGE = `Usage: total-recall preflight <command>
   ack --task "<task>" [--action read,edit,test] [--json]   Record a receipt after context ready:true and rules verify, and print the capsule.
@@ -19,9 +19,9 @@ const USAGE = `Usage: total-recall preflight <command>
   remind [--json]                                           Prompt-hook entry: advisory text when the receipt is missing; always exits 0
   session-start                                             Session-hook entry: after compaction or clear, the next ack prints the capsule; always exits 0
   install [--harness <id>|--all] [--dry-run]                Install the gate for a harness, or for every harness here. Install and update do this. No off switch.
-  mode [off|warn|enforce|clear] [--plugin <id>|--router] [--repo] [--json]
-                                                            Show or set what happens when work goes around a plugin. Default is warn.
-                                                            The preflight receipt itself has no off switch.
+  mode [enforce] [--plugin <id>|--router] [--repo] [--json]
+                                                            Show gate enforcement status. All plugin and routing gates are permanently
+                                                            enforced; off, warn, and clear bypasses are disabled.
   coverage [--dir <folder>] [--json]                        List plugins as declared or missing; exit 1 on a gap. Default: the shared plugin folder
   verify | report                                           Harness adapters, owned by the cli-agents plugin
 Aliases: total-recall tr-preflight --ack | --check. A receipt lasts 30 minutes (config preflight_max_age_minutes).
@@ -397,6 +397,33 @@ function projectBrainRoot(dir) {
   return brain && isBrainEnabled(brain.brainDir) ? brain.projectRoot : null;
 }
 
+/** How long a route's selection binds when the receipt names no window: the default receipt lifetime. */
+const ROUTE_SELECTION_MS = 30 * 60000;
+
+/**
+ * Records which harness a router command selected, so the gate can deny writes from the others.
+ * Called after the router plugin's own command runs, with what it printed. Output that is not a
+ * route result records nothing. Bookkeeping only: it never throws.
+ * @returns {string|null|undefined} the selected harness, null when the route chose none, undefined when nothing was recorded
+ */
+export function noteRouteSelection({ manifest, args = [], stdout = '', cwd = process.cwd() } = {}) {
+  try {
+    const router = manifest?.gate?.router;
+    if (!router?.pattern) return undefined;
+    const command = `${manifest.cli?.command || manifest.id} ${args.map(String).join(' ')}`;
+    if (!new RegExp(`(?:^|\\s)(?:${router.pattern})(\\s|$)`).test(command)) return undefined;
+    const text = String(stdout || '').trim();
+    let result;
+    try { result = JSON.parse(text); } catch { result = JSON.parse(text.split('\n').pop()); }
+    if (!result || typeof result !== 'object' || !('selected' in result)) return undefined;
+    const selected = typeof result.selected === 'string' && result.selected ? result.selected : null;
+    const root = findRoot(cwd);
+    markRouted(root);
+    markRouteSelection(root, selected);
+    return selected;
+  } catch { return undefined; }
+}
+
 /** The gate's answer to a call. Nothing here may throw, because an answer is all that keeps its repair reachable. */
 function evaluate(call, options = {}) {
   try {
@@ -450,6 +477,13 @@ function judge(call, { harness, readablePaths, session = null, subagent = false,
     ownerHealthy: (plugin, use) => ownerRuns(plugin, use, root),
     // A subagent or a run the router started reports to whoever routed the work.
     dispatched: runByRouter || subagent || Boolean(session && !ownAck),
+    // Only a named harness can be told apart from the one the router chose.
+    harness: harness && harness !== 'generic' ? harness : null,
+    routerRun: runByRouter,
+    selection: (receipt) => {
+      const chosen = lastRouteSelection(root);
+      return chosen && Date.now() - chosen.at < (limit ?? receipt?.limitMs ?? ROUTE_SELECTION_MS) ? chosen : null;
+    },
     check,
     recentConsult: () => {
       const now = Date.now();
@@ -569,14 +603,14 @@ async function mode(args) {
   const repo = args.includes('--repo');
   const brain = repo ? projectBrainDir(root) : globalBrainDirFor();
   if (value !== undefined) {
-    if (value !== 'clear' && !GATE_MODES.includes(value)) return fail(`Unknown mode "${value}". Choose ${GATE_MODES.join(', ')} or clear.`);
+    if (value !== 'enforce') return fail(`✖ Plugin and routing gates are permanently enforced and have no "${value}" bypass.`);
     const plugin = flag(args, '--plugin');
     const router = args.includes('--router');
     if (plugin && router) return fail('Choose --plugin or --router, not both.');
     if (plugin && !plugins.includes(plugin)) return fail(`No plugin here declares raw commands under "${plugin}". Declared: ${plugins.join(', ') || 'none'}.`);
     if (router && !declared.router) return fail('No plugin here declares a router.');
     if (repo && !fs.existsSync(brain)) return fail(`${root} has no project brain to hold this setting. Run total-recall init there, or leave off --repo.`);
-    writeGateMode(brain, { mode: value === 'clear' ? null : value, plugin, router });
+    writeGateMode(brain, { mode: 'enforce', plugin, router });
   }
   const layers = readGateLayers({ globalBrainDir: globalBrainDirFor(), root });
   const { adapters } = await loadGateAdapters(root);

package/src/core/gate-mode.mjs

@@ -1,19 +1,15 @@
 /**
  * Modes for the gate rules that steer work toward a plugin: raw commands a plugin owns, and
- * routing. `off` does nothing, `warn` lets the call run and tells the agent, `enforce` blocks.
- * The preflight receipt is not one of these rules and has no mode.
+ * routing. Gates are permanently enforced (`enforce`): there is no `off` or `warn` bypass.
  *
- * Settings live in `config/gate.json` in a brain:
- *   { "default": "warn", "router": "enforce", "plugins": { "git": "enforce" } }
- * The repository's brain wins over the machine's. This runs on every tool call, so it reads the
- * files directly, and an unreadable file or unknown value counts as unset: a bad settings file
- * must never be what blocks work.
+ * Settings live in `config/gate.json` in a brain. Any legacy `off` or `warn` values in
+ * `gate.json` are ignored so enforcement cannot be disabled on disk.
  */
 import fs from 'node:fs';
 import path from 'node:path';
 
-export const GATE_MODES = ['off', 'warn', 'enforce'];
-export const DEFAULT_GATE_MODE = 'warn';
+export const GATE_MODES = ['enforce'];
+export const DEFAULT_GATE_MODE = 'enforce';
 
 export const gateConfigPath = (brainDir) => path.join(brainDir, 'config', 'gate.json');
 export const projectBrainDir = (root) => path.join(root, '.agent', 'skills', 'total-recall');
@@ -30,39 +26,32 @@ export function readGateLayers({ globalBrainDir, root }) {
   return [readSettings(projectBrainDir(root)), readSettings(globalBrainDir)];
 }
 
-const known = (value) => (GATE_MODES.includes(value) ? value : undefined);
-
 /**
  * @param {object[]} layers from readGateLayers
  * @param {'router'|'owned'} kind
  * @param {string} [plugin] the owning plugin, for `owned`
  */
-export function resolveGateMode(layers, kind, plugin) {
-  for (const layer of layers) {
-    const specific = kind === 'router' ? known(layer.router) : known(layer.plugins?.[plugin]);
-    const mode = specific ?? known(layer.default);
-    if (mode) return mode;
-  }
+export function resolveGateMode(_layers, _kind, _plugin) {
   return DEFAULT_GATE_MODE;
 }
 
 /**
- * Change one setting and leave the others alone. A `mode` of null removes the setting, so
- * that level follows the next layer again.
+ * Persist `enforce` mode. `off`, `warn`, and clearing are refused.
  * @param {string} brainDir
  * @param {{ mode: string|null, plugin?: string, router?: boolean }} change
  */
 export function writeGateMode(brainDir, { mode, plugin, router }) {
+  if (mode !== 'enforce') {
+    throw new Error('Plugin and routing gates are permanently enforced and cannot be set to off, warn, or cleared.');
+  }
   const settings = readSettings(brainDir);
   if (router) {
-    if (mode === null) delete settings.router; else settings.router = mode;
+    settings.router = 'enforce';
   } else if (plugin) {
     settings.plugins = settings.plugins && typeof settings.plugins === 'object' ? settings.plugins : {};
-    if (mode === null) delete settings.plugins[plugin]; else settings.plugins[plugin] = mode;
-  } else if (mode === null) {
-    delete settings.default;
+    settings.plugins[plugin] = 'enforce';
   } else {
-    settings.default = mode;
+    settings.default = 'enforce';
   }
   const file = gateConfigPath(brainDir);
   fs.mkdirSync(path.dirname(file), { recursive: true });